Installation
Installation & setup
How do I install OpenSSL on Windows 10 or 11?
Download the Win64 prebuilt installer from Win64 Prebuilt, verify the SHA256 hash, run the installer, then add
C:\Program Files\OpenSSL-Win64in to your PATH. Run openssl version in a new terminal to confirm. Full guide: Add to PATH.Is this the official OpenSSL installer?
No. This site links to the prebuilt installer from Shining Light Productions (slprowex.com), a well-known third-party Windows build that has been available for years. The official OpenSSL project is at openssl.org. Always verify the SHA256 hash before running.
Light vs Full installer — which should I use?
Use Light (~5 MB) for running
openssl commands from the terminal. Use Full (~100 MB) if you are developing software that links against OpenSSL and needs header files and static libraries.How do I install OpenSSL on Windows Server 2019 / 2022?
Same installer as Windows 10/11, but install as Administrator and add to System PATH (not just User PATH) so service accounts can use it. See the full Windows Server guide.
How do I verify the installer is safe?
Run
certutil -hashfile Win64OpenSSL_Light-4_0_0.exe SHA256 and compare to the hash on slprowex.com. Full guide: Verify Hashes.How do I update OpenSSL to a newer version?
Download the new installer and run it over the existing installation to the same folder. Your PATH settings are preserved. See Update OpenSSL on Windows.
PATH & terminal
PATH and terminal errors
openssl is not recognized as an internal or external command
The OpenSSL bin folder is not on your PATH, or you have not opened a new terminal after adding it. Add
C:\Program Files\OpenSSL-Win64in to User PATH, close all terminals, open a new one and try again. Full guide: Fix not recognized error.I added PATH but still get "not recognized"
You are running the command in the same terminal that was open before you added PATH. PATH changes only apply to new process instances. Close the terminal and open a fresh one.
openssl works in cmd.exe but not PowerShell (or vice versa)
Both shells use the same User PATH. The failing shell was opened before the PATH change. Open a new window for it.
openssl shows the wrong version (from Git or another tool)
Run
where openssl to see which binary wins. Move C:\Program Files\OpenSSL-Win64in to the top of PATH in Environment Variables so it takes priority.
DLL errors
libcrypto.dll and libssl.dll errors
libcrypto-3-x64.dll was not found
Most commonly caused by a 32/64-bit mismatch or missing VC++ Redistributable. Install the Microsoft Visual C++ Redistributable x64, ensure you used the Win64 installer, and add the bin folder to PATH. Full guide: Fix libcrypto.dll.
DLL error persists after installing VC++ Redistributable
Try rebooting. Also confirm you installed the x64 package. If it still fails, reinstall OpenSSL from the Win64 Prebuilt.
My app bundles the DLL — which filename should I use in OpenSSL 3.x?
OpenSSL 3.x uses
libcrypto-3-x64.dll and libssl-3-x64.dll. OpenSSL 1.1.1 used libcrypto-1_1-x64.dll. Copy the correct 3.x DLLs from C:\Program Files\OpenSSL-Win64in\ next to your application's executable.
Commands
Common command questions
How do I generate an RSA key?
openssl genrsa -out key.pem 2048 for a 2048-bit key. Use 4096 for stronger keys. Add -aes256 to encrypt with a passphrase. Full guide: Generate RSA key.How do I generate a CSR?
openssl req -newkey rsa:2048 -nodes -keyout key.pem -out req.csr. Follow the prompts for country, organization and common name (your domain). Full guide: Generate CSR.How do I create a self-signed certificate?
openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365. For Chrome/Firefox, add SAN extensions via a config file. Full guide: Self-signed certificate.How do I convert PFX to PEM?
Extract key:
openssl pkcs12 -in cert.pfx -nocerts -nodes -out key.pem. Extract cert: openssl pkcs12 -in cert.pfx -nokeys -out cert.pem. Full guide: Convert PFX to PEM.How do I check a certificate's expiry date?
Local file:
openssl x509 -in cert.pem -noout -dates. Remote server: openssl s_client -connect example.com:443 2>nul | openssl x509 -noout -dates. Full guide: Check certificate.How do I test a TLS connection to a server?
openssl s_client -connect example.com:443. Add -servername example.com for SNI. Use -tls1_2 or -tls1_3 to test specific versions. Full guide: Test SSL connection.
Versions
Version and compatibility
What is the latest OpenSSL version for Windows?
OpenSSL 4.0.0 (released April 2026) is the latest stable release. Download the Win64 prebuilt from Win64 Prebuilt. Check slprowex.com for the latest Windows builds.
What are the main differences between OpenSSL 3.x and 1.1.1?
Key changes: new provider model replacing ENGINE, DLL filename changes (
libcrypto-3-x64.dll), legacy algorithms (MD4, RC4, DES) moved to opt-in legacy provider, and many low-level API functions deprecated. See OpenSSL 3 vs 1.1.OpenSSL vs LibreSSL — which should I use on Windows?
OpenSSL. LibreSSL has no official Windows prebuilt installer and Windows-specific testing is limited. The Windows ecosystem expects OpenSSL. See OpenSSL vs LibreSSL.
Does OpenSSL 4.0 work on Windows Server 2019 / 2022?
Yes. The Win64 prebuilt supports Windows 10, 11 and Windows Server 2019/2022. See Windows Server guide.
Everything you need is here
20 guides covering the full OpenSSL workflow on Windows.